PocketIDOIDCClient

pocketid.internal / v1alpha1

apiVersion: pocketid.internal/v1alpha1 kind: PocketIDOIDCClient metadata: name: example

apiVersion string

APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources

kind string

Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds

metadata object

spec object

spec defines the desired state of PocketIDOIDCClient

accessTokenDurationMinutes integer

How long access tokens issued to this client stay valid, in minutes.

format: int64

minimum: 1

maximum: 525600

allowedUserGroups []object

AllowedUserGroups restricts access to the listed user groups. Each entry names either a PocketIDUserGroup CR or, for groups managed outside this cluster, an existing Pocket-ID group by name or ID.

groupID string

GroupID is the Pocket-ID ID of an existing user group, for groups not managed by a PocketIDUserGroup in this cluster.

minLength: 1

maxLength: 64

groupName string

GroupName is the name of an existing user group in Pocket-ID, for groups not managed by a PocketIDUserGroup in this cluster.

minLength: 2

maxLength: 255

name string

Name is the name of the PocketIDUserGroup CR

minLength: 1

maxLength: 253

namespace string

Namespace is the namespace of the PocketIDUserGroup CR. Defaults to the PocketIDOIDCClient namespace.

minLength: 1

maxLength: 63

apiAccess []object

APIAccess grants this client permission to request scoped access on the referenced PocketIDAPIs.

apiRef object required

APIRef references the PocketIDAPI granting access.

name string required

Name is the name of the PocketIDAPI CR.

namespace string

Namespace is the namespace of the PocketIDAPI CR. Defaults to the referencing resource's namespace.

clientAccess boolean

ClientAccess grants the client-credentials flow even with no permissions selected. Defaults to true when clientPermissions is non-empty, and requires a confidential client.

clientPermissions []string

ClientPermissions are permission keys granted for the client-credentials (machine-to-machine) flow. These require a confidential client.

delegatedAccess boolean

DelegatedAccess grants the user-delegated flow even with no permissions selected, e.g. a client requesting a resource that doesn't need any scopes. Defaults to true when delegatedPermissions is non-empty.

delegatedPermissions []string

DelegatedPermissions are permission keys granted for the user-delegated (authorization code) flow, where the client acts on behalf of a user.

backchannelLogoutUrl string

Back-channel logout URL Pocket-ID notifies when a user's session for the client ends.

callbackUrls []string

Callback URLs for the client.

clientID string

ClientID is the optional OIDC client ID to use instead of a generated one. The Client ID is immutable and cannot be changed once the oidc client is created. An https:// URL marks the client as an OAuth Client ID Metadata Document (CIMD) client, which the operator adopts but never creates and only partially manages.

minLength: 2

maxLength: 512

clientSecretOverlap string

ClientSecretOverlap is how long the client-secret a replacement supersedes stays valid in Pocket-ID, giving consumers time to rollout and pick up the new one. When unset or zero the previous secret is deleted as soon as the replacement is stored, so exactly one secret is ever valid. Must not exceed 168h, nor clientSecretRotation.interval if set.

clientSecretRef object

ClientSecretRef references a Kubernetes Secret key holding the client secret to set in Pocket-ID, instead of letting the operator generate one. The value must be at least 16 printable ASCII characters. While set, the operator never generates or rotates the secret.

key string required

The key of the secret to select from. Must be a valid secret key.

name string

Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names

optional boolean

Specify whether the Secret or its key must be defined

clientSecretRotation object

ClientSecretRotation configures automatic, scheduled regeneration of the client secret. When unset the secret is only regenerated on create/adopt, on self-heal, or when the regenerate-client-secret annotation is set.

enabled boolean required

Enabled controls whether automatic rotation is active.

interval string

Interval is the minimum time between rotations (e.g. "720h" for 30 days). Must be between 1h and 8760h. When omitted, rotation is driven entirely by window (which then becomes required) and the secret rotates once per window opening.

window object

Window restricts rotations to a recurring maintenance window. When interval is set, rotations fire as soon as the interval and global min-spacing are satisfied, confined to the window when one is configured. When interval is omitted, the window opening is the trigger and the secret rotates once per opening subject to min-spacing.

closesAfter string required

ClosesAfter is how long the window stays open after each cron fire. Minimum 5m.

opens string required

Opens is a standard 5-field cron expression (e.g. "0 1 * * *" for 1am daily, local TZ).

darkLogoUrl string

Deprecated: Use spec.logo.darkLogoUrl instead.

description string

Description is an optional description for the client

maxLength: 150

federatedIdentities []object

FederatedIdentities configures JWT assertion identities.

audience string

Audience is the audience for the identity.

issuer string

Issuer is the OIDC issuer for the identity.

jwks string

JWKS is the URL of the identity's JWKS. Defaults to the issuer's /.well-known/jwks.json.

publicKeys []object

PublicKeys are the keys that verify the identity's assertions, used instead of a JWKS URL.

value object

Value is a JWK.

valueFrom object

ValueFrom reads a JWK, or a JWKS whose keys are all used, from a ConfigMap or Secret. It is re-read on every reconcile, so key rotation is picked up on the next resync.

configMapKeyRef object

Selects a key from a ConfigMap.

key string required

The key to select from the ConfigMap's Data field. Keys in the BinaryData field are not currently propagated to container env vars.

name string

optional boolean

Specify whether the ConfigMap or its key must be defined

secretKeyRef object

SecretKeySelector selects a key of a Secret.

key string required

The key of the secret to select from. Must be a valid secret key.

name string

optional boolean

Specify whether the Secret or its key must be defined

replayProtection boolean

ReplayProtection requires client assertions to carry a jti and rejects replays.

subject string

Subject is the subject for the identity.

instanceSelector object

InstanceSelector selects the PocketIDInstance to reconcile against. If omitted, the controller expects exactly one instance in the cluster.

matchExpressions []object

matchExpressions is a list of label selector requirements. The requirements are ANDed.

key string required

key is the label key that the selector applies to.

operator string required

operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.

values []string

values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.

matchLabels object

matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.

isPublic boolean

Indicates if the client is public (no client secret).

launchUrl string

Launch URL for the client. Used in the "apps" dashboard in the Pocket-ID ui.

logo object

Logo configures logo URLs for the OIDC client with template support.

autoGenerate boolean

AutoGenerate controls whether to auto-generate logo URLs from templates when logoUrl/darkLogoUrl are not explicitly set in this struct. If not set, defaults to the AUTOGENERATE_LOGOS env var on the operator, which defaults to true.

darkLogoUrl string

DarkLogoURL is the URL template for the dark logo. Use as a placeholder for the logo name. Defaults to the DEFAULT_DARK_LOGO_URL env var on the operator.

logoUrl string

LogoURL is the URL template for the light logo. Use as a placeholder for the logo name. Defaults to the DEFAULT_LOGO_URL env var on the operator.

nameOverride string

NameOverride overrides the logo name used in template substitution. Defaults to metadata.name.

logoUrl string

Deprecated: Use spec.logo.logoUrl instead.

logoutCallbackUrls []string

Logout callback URLs for the client.

name string

Name of the oidc client to create in Pocket ID. If omitted, defaults to metadata.name of the oidcclient resource.

pkceEnabled boolean

Enables PKCE for the client.

refreshTokenDurationMinutes integer

How long refresh tokens issued to this client stay valid, in minutes.

format: int64

minimum: 1

maximum: 525600

requiresPushedAuthorizationRequests boolean

Requires the client to use pushed authorization requests (PAR).

requiresReauthentication boolean

Requires reauthentication on login.

scim object

SCIM configures SCIM provisioning for this OIDC client. Pocket ID will push user/group changes to the configured endpoint.

endpoint string required

Endpoint is the URL of the external SCIM service provider.

tokenSecretRef object

TokenSecretRef references a Kubernetes Secret key containing the bearer token used to authenticate with the SCIM endpoint. If omitted, no Authorization header is sent.

key string required

The key of the secret to select from. Must be a valid secret key.

name string

optional boolean

Specify whether the Secret or its key must be defined

secret object

Secret defines how OIDC client credentials should be stored in a Kubernetes Secret.

additionalAnnotations object

AdditionalAnnotations allows setting custom annotations on the secret created by the PocketIDOIDCClient custom resource. Operator-managed annotations take precedence and cannot be overridden.

additionalLabels object

AdditionalLabels allows setting custom labels on the secret created by the PocketIDOIDCClient custom resource

enabled boolean

Enabled controls whether to create a secret with OIDC client credentials. If false, no secret will be created. Defaults to true.

keys object

Keys allows customization of the secret keys for each credential field.

authorizationUrl string

AuthorizationURL is the key name for the OIDC authorization endpoint URL.

callbackUrls string

CallbackURLs is the key name for the callback URLs.

clientID string

ClientID is the key name for the OIDC client ID.

clientSecret string

ClientSecret is the key name for the OIDC client secret.

discoveryUrl string

DiscoveryURL is the key name for the OIDC discovery URL.

endSessionUrl string

EndSessionURL is the key name for the OIDC end session (logout) endpoint URL.

issuerUrl string

IssuerURL is the key name for the OIDC issuer URL.

jwksUrl string

JwksURL is the key name for the OIDC JWKS (JSON Web Key Set) endpoint URL.

logoutCallbackUrls string

LogoutCallbackURLs is the key name for the logout callback URLs.

resource string

Resource is the key name for the audience to request tokens for, taken from the APIs in apiAccess. It also prefixes the per-API key "<resource>_<apiRef.name>".

scopes string

Scopes is the key name for the space-delimited scopes apiAccess grants the client-credentials flow. It also prefixes the per-API key "<scopes>_<apiRef.name>".

tokenUrl string

TokenURL is the key name for the OIDC token endpoint URL.

userinfoUrl string

UserinfoURL is the key name for the OIDC userinfo endpoint URL.

name string

Name is the name of the secret to create. Defaults to metadata.name + "-oidc-credentials"

storeClientSecret boolean

StoreClientSecret controls whether the operator manages the client secret. When false, a client created by the operator still gets its initial secret minted and stored, while an adopted client keeps its externally-managed secret and the Secret omits the client_secret key.

skipConsent boolean

Skips the consent screen on initial authorization for this client.

status object

status defines the observed state of PocketIDOIDCClient

allowedUserGroupIDs []string

AllowedUserGroupIDs are the resolved group IDs assigned to the client

callbackUrls []string

CallbackURLs are the current callback URLs from Pocket-ID

cimdGrantedAPIs []string

CIMDGrantedAPIs are the resources of APIs reachable through their cimdAccess setting rather than this client's own grant; revoke it on the PocketIDAPI, not via spec.apiAccess. Only populated for cimd clients.

clientID string

ClientID is the ID assigned by Pocket-ID.

clientSecretSourceVersion string

ClientSecretSourceVersion identifies the spec.clientSecretRef source last pushed to Pocket-ID. Pocket-ID stores the secret hashed and never returns it, so this is how the operator detects that the referenced Secret changed and needs pushing again.

clientType string

ClientType is how the client was registered in Pocket-ID: "standard" or "cimd". For a "cimd" client the operator manages only the fields Pocket-ID persists on an admin update; the rest are owned by its OAuth Client ID Metadata Document.

conditions []object

Conditions represent the current state of the PocketIDOIDCClient resource.

lastTransitionTime string required

lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.

format: date-time

message string required

message is a human readable message indicating details about the transition. This may be an empty string.

maxLength: 32768

observedGeneration integer

observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.

format: int64

minimum: 0

reason string required

reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty.

pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$

minLength: 1

maxLength: 1024

status string required

status of the condition, one of True, False, Unknown.

enum: True, False, Unknown

type string required

type of condition in CamelCase or in foo.example.com/CamelCase.

pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$

maxLength: 316

createdAt string

CreatedAt is the creation timestamp from Pocket-ID

darkLogoReachable boolean

DarkLogoReachable reports whether Pocket-ID could fetch and store the dark logo from the URL the spec resolves to.

darkLogoUrl string

DarkLogoURL is the dark logo URL the operator last successfully applied to Pocket-ID.

lastRotatedAt string

LastRotatedAt is the time the client secret was last regenerated by the operator. Used to determine when the next scheduled rotation is due.

format: date-time

logoReachable boolean

LogoReachable reports whether Pocket-ID could fetch and store the light logo from the URL the spec resolves to.

logoUrl string

LogoURL is the light logo URL the operator last successfully applied to Pocket-ID.

logoutCallbackUrls []string

LogoutCallbackURLs are the current logout callback URLs from Pocket-ID

managedAPIPermissionIDs []string

ManagedAPIPermissionIDs are the Pocket-ID API permission IDs the operator last pushed as this client's API access (both delegated and client-credentials).

managedAPIs []string

ManagedAPIs are the Pocket-ID API IDs the operator last granted this client.

name string

Name is the resolved name from Pocket-ID.

pkceSupported boolean

PKCESupported indicates Pocket-ID observed the client using PKCE during an authorization flow while spec.pkceEnabled is false, signalling PKCE can be enabled.

scimProviderID string

SCIMProviderID is the pocket-id ID of the SCIM service provider for this client, if configured.

No matches. Try .spec.accessTokenDurationMinutes for an exact path